arXiv: 1507.03765v2 [quant-ph] 17 Sep 2015 


A complete Classification of Quantum Public-key 
Encryption Protocols 


Chenmiao Wu Li Yang^’^* 

1. State Key Laboratory of Information Security, Institute of Information Engineering, 

Chinese Academy of Sciences, Beijing 100093, China 

2. Data Assurance and Communication Security Research Center, Chinese Academy of 

Sciences, Beijing 100093, China 

3. University of Chinese Academy of Sciences, Beijing, 100049, China 


Abstract 

We present a classification of qnantnm pnblic-key encryption protocols. There 
are six elements in qnantnm public-key encryption: plaintext, ciphertext, 
public-key, private-key, encryption algorithm and decryption algorithm. Ac¬ 
cording to the property of each element which is either quantum or classical, 
the quantum public-key encryption protocols can be divided into 64 kinds. 
Among 64 kinds of protocols, 8 kinds have already been constructed, 52 kinds 
can be proved to be impossible to construct and the remaining 4 kinds have 
not been presented effectively yet. This indicates that the research on quan¬ 
tum public-key encryption protocol should be focus on the existed kinds and 
the unproposed kinds. 
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1. INTRODUCTION 

Diffie and Heilman [l| lay the foundation of modern cryptography by 
presenting the concept of public-key encryption. Contrary to symmetric-key 
encryption which uses the same key to encrypt and to decrypt, pub lie-key 
encryption uses a pair of different keys, public-key and private-key, to encrypt 
and to decrypt. Classical public-key encryption has been widely used in 
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many fields. However, Shor’s algorithm and Cover’s algorithm [jj can 
attack the computational difficulty problems which are used as the premises 
of constructing classical public-key encryption. The research on quantum 
public-key encryption can pre-empt such potential threats. 

Analogous to the analysis of quantum symmetric-encryption protocols j^, 
a quantum pub lie-key encryption consists of six elements: plaintext, cipher- 
text, public-key, private-key, encryption algorithm and decryption algorithm. 
If an encryption protocol involved quantum part, it can be taken as the 
counterpart of classical public-key encryption. With the advent of quantum 
key distribution protocol, BB84|^, quantum public-key encryption has at¬ 
tained great development. Okamoto’s protocol^ is considered as the first 
public-key encryption protocol which is based on the Knapsack-set prob¬ 
lem. Gottesman|7| hrstly proposed ’’quantum public key cryptography with 
information-theoretic security”. Up to now, there are some quantum public- 
key encryption protocols. For purpose of further analyzing the property of 
quantum public-key encryption and constructing new protocols, we classify 
the quantum public-key encryption protocols. 

This paper is organised as follows: a brief classihcation of quantum public- 
key encryption protocols is given in section 2; we classify these protocols into 
3 types, each type is explained in section 3,4,5; in section 6, we discuss 
some problems exist in quantum public-key encryption protocols; finally, 
conclusions are drawn in section 7. 


2. Classification of quantum public-key encryption protocols 

A quantum public-key encryption protocol is a six-tuple (P, (7, PK, SK, S’, 
&)\ plaintext (P), ciphertext (C), public-key (PK), private-key (SK), en¬ 
cryption algorithm [S) and decryption algorithm (^). Each element can 
be either classical or quantum, so there are 64 kinds of quantum public- 
key encryption protocols in total. Among them, 8 kinds have already been 
constructed, 52 kinds can be proved to be impossible to construct and the 
remaining 4 kinds have not been presented effectively yet. Thus, we can 
classify them into three types. The detail classification is show in table 1. 

In Table 1, C denotes the element belongs to classical space, Q denotes 
the element belongs to quantum space, E means the protocol exists, M means 
the protocol does not exist, O means whether this kind of protocol exists or 
not is still an open problem. 
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Table 1: 64 kinds of quantum public-key encryption protocols 
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3. Type E 


In this section, we will give simple examples about the existing 8 kinds 
of quantum public-key encryption protocol. The numbers of these protocols 
are 1, 2, 8, 20, 32, 40, 52, 64. 

3.1. Kind 1 

Broadly speaking, the classical public-key encryption protocol is a special 
case of quantum public-key encryption protocol. Each elements in Classical 
public-key encryption protocol is belong to classical space. There is no doubt 
that Kind 1 exists, such as RSAj^ , ECC cryptosystem , Rabin cryptosys¬ 
tem [l^ and so on. Okamoto proposed a QPKE protocol based on the 
Knapsack-set problem. All the six elements of this protocol are classical, but 
the participants are all quantum Turing machines. 

3.2. Kind 2 

This kind uses quantum computation to decrypt. Supposed that dur¬ 
ing the decryption of ElGamal cryptosystem 0 ' , the participant can use 
Shor’s algorithm to solve the discrete problem to get the transmitted mes¬ 
sage. Quantum attack to the classical PKE protocol is also belong to this 
kind. 


3.3. Kind 8 

P, PK, SK e C and (7, (f, G Q according to the kind 8. We can use 
the QPKE[i^ based on the McEliece cryptosystem 131 to transmit classical 
message x. 


Protocol 1 (P, PK, SK G C; G, G Q). Let Alice’s public-key be G\ 
G = SGP. S is an invertible matrix, P is a permutation matrix and G is a 
generator matrix of a Goppa code. And let her private-key be (S', G, P). 

[Encryption] Bob uses Alice’s public-key G' to encrypt the classicla mes¬ 
sage X as below: 


1. he prepares a quantum sate |x) and does Hadamard transformation on 
it: 


x) 


^ m 

= y^^a^\m) 


( 1 ) 


4 




2. he does transformation on the quantum message with Alice’s public- 
key: 


m\m)k\^)n) = y^^am\m)k\mG')n] 


( 2 ) 


3. he randomly chooses an error e to add into the state: 

Otm\‘^G )77,) ^ ^ 0;777,|?7rG ® ^)n7 (3) 

m m 

and then sends ^ © e)„ to Alice. 

m 

[Decryption] Alice uses her private-key (S', G, P) to decrypt the receiving 
ciphertext: 

1. she uses P~^ to do computation: 

Up-iC^a^\m)k\mG' © e)„) = am\m)k\mSG © e)^; (4) 

m m 

2. she takes advantage of H to apply the operator Uh'- 

uh(J 2« m\mSG © e)„|0)„_fc) = am\mSG © e)n\s)n-k, (5) 

m m 

and then measures the second register to get the syndrome to hnd the 
error via the fast decoding algorithm of the Goppa code generated by 
G; 


3. she uses error vector e to do computation: 

UeiYl OifYi^TTlSGr ^3 ^)n) ^ ^ nj 


( 6 ) 


and also uses the inver matrix of G to do transform: 

UG-i(^am\mSG)n\0)k) = '^am\mSG)n\mSGG~^)k, (7) 

m m 

4. hnally, she does computation according to S*”^ to get the quantum 
message: 

Us-i(^am\mS)k) = y^^am\mSS~^)k 


3 ^ 


( 8 ) 
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3.4- Kind 20 

Kind 20 represents that F, SK G C and C, PK, S', ^ & Q. This kind 
consists of two subclasses, one is that the public-key is composed only by 
quantum state, the other is that it employs a random changed pair of classical 
string and quantum state as public-key. 

Protocol 2 (P, SK e C;aPK, eQ). 

In Kawachi’s protocolfl^, the public-key is the quantum state = |cr) -|- 
|cT7r), where a E Sn- And the private-key is a permutation tt selected from 
Sn. 

[Encryption] 

1. If Bob intends to send message ”0” to Alice, he sends Alice p+, 

2. If he wants to transmit ”1”, he sends Alice where p“ is obtained 
from the operations as follows: 

|a) + |(T7r) ^ (9) 

[Decryption] Alice decrypts Bob’s ciphertext using the private-key vr. 

Protocol 3 (P, SK E C; C, PK, eQ). 

Quantum public-key encryption protocol [l^ based on conjugate coding 
employs a random changed pair of bit string and quantum state as public- 
key and a Boolean function as private-key. Let the public-key be 
the private-key be P, where s is used just once time, i E fib, fib = ^ 

{0,1}"'|A © • • • © = 6}. The owner of private-key uses bit string of public- 

key s as input to F to compute k which is an important element in preparing 
quantum state. 

[Encryption] 

1. Bob wants to transmit one bit message b to Alice, he gets one of Alice’s 
public-key and then selects a bit j from fib, 

2. He applies to H^\i), 

3. He sends {s,Y ^to Alice. 

[Decryption] 
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1. Alice calculates F{s) = k, 


2. She removes the transformation from the quantum state, and gets 


Y^\i), 

3. She measures Y^\i) with basis {0,1}" to acquire the plaintext. 


3.5. Kind 32 

This kind requests that P G C and C,PK,SK Qi G Q. Kind 32 



usually uses EPR pairs as public-key and private-kevjld. Il7 


Protocol 4 (P G C; C, pP, sP, (f, G Q) . 

Denote the public-key as Sp = {pi,P 2 , • • • ,Pn} and private-key as Sq = 
{qi,q2, ■ ■ ■,qn}- Both the public-key and private-key are in the Bell state: 
I*h’'')i 2 = :^(|00)i2 -l- |ll)i 2 ). Particle 1 is belong to public-key and particle 
2 is private-key. 

[Encryption] If Bob intends to send r-bit classical message m = {mi, m 2 , ■ ■ ■, 

1. he prepares r-qubit quantum state \m) = \m 2 ),..., 

2. he uses Alice’s pub lie-key Sp to do CNOT operations on the prepared 
quantum state: 



( 10 ) 


3. sends all these particles to Alice. 

[Decryption] 

1. When receiving ciphertext, Alice uses her private-key Sq to do CNOT 
operations: 



( 11 ) 


2. Alice measures the state with basis {|0), |1)} to get the plaintext. 
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3.6. Kind 40 

This kind aims at encrypting quantum message, requiring PK, SK G C 
and P, G Q. Li Yang and Fuiita proposed some quantum counter¬ 


parts of McEliece cryptosystem 12|, ll8|] . Such protocols are belong to this 
kind. We can use Protocol 1 to transmit quantum message, so this kind 
exists. 


3. 7. Kind 52 

This kind requersts: SK G C and P, C, PK, S’, ^ G Q. Gotteseman 
was the hrst one to consider quantum state as public-key, and proposed an 
information-theoretically secure qpkeQ. 

Protocol 5 (sK G C; P, C,pK, S,3! eQ). 

Let Alice’s public-key be \'il}) = ■^(/®f/fc)(|0)|0)-|-|l)|l)), and private-key 
be k. 

[Encryption] 

Bob uses Alice’s public-key to encrypt quantum menssage |(p) = q;|0) -|- 
/ 3 | 1 ): 

he teleports the quantum message through the public-key: 

mi>) = Y(a|O) + f)|l))(|O)®(7^|O> + |l)0C/j|l)) (12) 

and by measuring the hrst and second particles, the whole system becomes: 
1^)1^) = i|<p+)(af/,|0)+/?Pfc|l)) + i|<h-)(af/fc|0)-/3[/,|l)) + 
^|T+)(/3[/,|0) + aUk\l))^\^-){ - f3Uk\0) + aUk\l)) 

+^|T+)[/fc o X\ip) + o XZ\p). (13) 

Bob gets the corresonding Pauli matrix P and sends Alice P and 2nd 
register of public-key. 

[Decryption] 

After receiving ciphertext {P,UkP\(p)), Alice decrypts it by performing 
then P~^, and gets the plaintext \ip). 






Remark 1. The kind 52 can be extended to a multi-qubit protocol with the 
help of the multi-qubit unknown state teleportation, which can be accom¬ 
plished in a qubit-wise way. The feasibility of this kind of teleportation can 


be proved with mathematical induction [19 


The teleportation of two-qubit state has been studied in the Ref. [20 


22| . Now, we suppose (n—l)-qubit state: |'0i) = ^ 


a. 


n,.. 


ri-1 ri) 


211 , 

^n—l) 


1 

has been already transmitted successfully by the same way of sending two- 
qubit state. And the operations to reconstruct the (n — 1) particles are 
[/i (g) • • • 0 Un-i- Now, we prove that the quantum state of n-qubit state will 
be send by n EPR pairs 1$^). 

The arbitrary n-qubit unknown state is a mixed state, which is the super¬ 
position of each component: |'02) = X] ..ini'll ■■■The teleporta- 


il.. .in 


tion of \'ijj 2 ) is equal to teleport each component. The mixed state is also 
pure state, and each component is independent. Thus, |'02) can be expressed 
as: \'ijj 2 ) = |'*/' 2 i)| 0 ) + |'*/' 22 )| 1 ), where |' 02 i) and |' 022 ) are independent of each 
other. So another expression of |'02) is: 


|'02) — |'02l)l,...,n-l|O)n + |'022)l,...,n-l|l)n 

^ “i' i' IR • • • *n-l)l,...,n-l|0)n + 

./ ./ 

^ ^ cr» II (14) 


Alice and Bob preshare EPR pair |<h+)„+i^„+ 2 , ■ ■ ■, |4>’^)3n-l,3n- Based on the 
assumption that {n — l)-qubit state is transmitted by the same method of 
qubit-wise teleportation. Bob also sends the nth qubit through teleportation. 
Since the mixed state can be considered as pure state, we conclude the pre¬ 
viously transmitted (n — 1) qubits in the the following operation to simplify 
expression: X) 

2i.. .in 

If Bob performs Bell measurement on particle n and particle 3n — 1, his 
measurement outcome should be one of the four possibilities: |‘h^)n, 3 n-i, 
|4)“)n,3n-i, |4'+)n,3n-i and |d'”)n, 3 n-i- The probability of each result is 
Once Alice receives the message send by Bob, she can £x up her state, recov¬ 
ering 1-02), by applying the appropriate quantum gate Ui® ■ ■ ■ ®Un- To each 
operation f/j, if Bob’s measurement outcome yields 1$’'"), Alice does not need 
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to do anything. If the measurement outcome is |<h“) then Alice can fix up 
her state by applying the Z gate. If the measurement outcome is Alice 
does transformation X to reconstruct the state. If jd'”), Alice uses first an 
X and then a Z gate to recover the state. 

3.8. Kind 64 

All the six elements in this kind are belong to quantum space, we give a 
simple example as follows: 

Protocol 6 (P, C, PK, SK, ^ e Q). 

Let plaintext be Public-key Spk and private-key Ssk are in 

m 

the entangled state :^(|0)^|0 )b + |1)a|1)b)- 

[Encryption] 

1. Bob performs CNOT operation on the quantum state with Alice’s 
public-key Sp^. 

^Pik li — + I ) (15) 

m ^ 

2. Bob sends the ciphertext to Alice. 

[Decryption] 

1. Alice decrypts with her private-key Ssk'- 

(16) 

2. Alice gets the plaintext in the second register. 

4. Type N 

As shown in Table 1, 52 kinds protocol are unable to be constrcuted. The 
encryption expression of QPKE can be written as: 

C = EncpK{P). (17) 
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It refers to that giving plaintext and public-key to the encryption algorithm, 
the output is the ciphertext. 

The expression of decryption is: 


P = DecsKiC). (18) 

The input for the decryption algorithm are ciphertext and private-key, and 
the plaintext will be obtained. 

According to Eq. 18, if one element of both the input and output is 
belong to quantum space, the encryption algorithm must have the ability to 
process quantum elements. So the encryption algorithm should be belong to 
quantum space. Through this analysis, we can conhrm that kind 5, 6, 9, 10, 
17, 18, 21, 22, 25, 26, 29, 30, 33, 34, 37, 38, 41, 42, 45, 46, 49, 50, 53, 54, 57, 

58, 61, 62 does not exist. 

Analogous to encryption process, if one of private-key, ciphertext and 
plaintext is belong to quantum space, the decryption algorithm is also belong 
to quantum space. So kind 7, 11, 15, 19, 23, 27, 31, 35, 39, 43, 47, 51, 55, 

59, 63 are impossible to construct. 

When one of the inputs for the quantum encryption algorithm, plaintext 
or public-key, the output should be quantum states. If not, it means Quan¬ 
tum coherent components disappear after encryption and the output remains 
only one component. So quantum state degenerates into a classical one. That 
is, most of the information in plaintext are missing with the processing of 
encryption. Such protocol is useless in transmitting message. Kind 12, 24, 
36, 44, 48, 56 are non-exist. 

Similarly, if either ciphertext or private-key is quantum during the process 
of decryption, the plaintext must be quantum states. The reason is the same 
with encryption processing. Thus, kind 13, 14, 16 are impossible. 

5. Type O 

For Kind 3: {P,C,PK,SK,^ G G Q), Kind 4: {P,C,PK,SK G 
C; ^ G Q), Kind 28: (P, PK, G C; C, SK, eQ) and Kind 60: (PAT, G 
C] P,C, SK, S’, ^ G Q), we are uncertain about their existence and also 
cannot determin their non-existence. If we consider classical plaintext as a 
special case of quantum plaintext. Kind 28 can be classified into Kind 60. 
There may be some novel and intersting QPKE protocols of Kind 3, 4, 28, 
60 which are worth further studying. 
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6. Discussion 

By classification, we review some QPKE protocols that are fully studied, 
make a list of impossible QPKE protocols and figure out the kinds which 
their existence is still an open problem. However, when it comes to type 
O, we cannot either give a proof of its existence or of its non-existence. 
In this paper, public-key distribution and the key generation are not taken 
into consideration. If these two phase are considered in the classihcation of 
QPKE protocols, the problem would be more complex, and there may be 
more interesting QPKE protocols to think about. 

In public-key encryption protocol, there are some security notions, such 
as computational security, information-theoretically security, semantic secu¬ 
rity, malleable, non-malleable and so on. If we classify the QPKE protocols 
according the security notions, the classihcation will be more complex but 
more specihc. 

7. Conclusions 

Based on the six-tuple of QPKE, we classify the 64 kinds of QPKE pro¬ 
tocols into three types. First type includes 8 kinds of protocols that all have 
been presented yet and worth deeply studying. Second type includes 52 kinds 
of protocols that are are proved to be unable to construct or are no use to 
construct. The remaining protocols are worth further discussing. 
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